Google authentication giving invalid credentials.

[abhinavgautam07]

We have 2 setups of kafka, one each for dev and prod. I want to setup UI with RBAC for both of them. Google authentication seems to be working fine on Dev, but giving invalid creds on prod.

config for dev and prod.
configs.zip

DEVELOPMENT

PRODUCTION

[Haarolean]

Hey, please try redirect-uri with dash instead of an underscore. Let me know how it goes.

Also, a tip: you can enable browser's developer console once you authenticate, you might get useful info upon an auth error (look at the URLs of requests).

[abhinavgautam07]

still the same issue.

Getting 302 not found in network call.

[Haarolean]

@abhinavgautam07 302 is "found", not "not found", it's a redirect.

• Check the next request (login?error) is there anything useful there?
• Try removing redirect uri from your config at all
• Try adding a scope (scope: openid) along other variables.

[fedeostrit]

Hi, I wanted to know if there is any way to configure google's oauth2 and use the google provider to do RBAC by groups and not just by user or entire domain as shown in the documentation:
oauth2:

kafka:
clusters:
- name: local
bootstrapServers: localhost:9092
# ...

auth:
type: OAUTH2
oauth2:
client:
google:
provider: google
clientId: xxx.apps.googleusercontent.com
clientSecret: GOCSPX-xxx
user-name-attribute: email
custom-params:
type: google
allowedDomain: provectus.com

provider:
- name: "memelords"
subjects:
- provider: oauth_google
type: domain
value: "memelord.lol"

It only allows you to use domain or user, but if I have 100 users, I would have to create a role for each one and map it in a huge .yaml file. Also, when a new resource enters, it must be modified to add it.

[Haarolean]

#3274